Home/ Questions/Q 8599903
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T01:29:55+00:00

Browsers allow extensions to inject code, manipulate the DOM, etc. Over the years, I

  • 0

Browsers allow extensions to inject code, manipulate the DOM, etc.

Over the years, I have noticed lots and various uncaught errors (using window.onerror) on a website (app) I am watching, generated by unknown browser extensions on Firefox, Chrome and Internet Explorer (all versions).

These errors didn’t seem to be interrupting anything. Now I want to increase the security of this website, because it will start processing credit cards. I have seen with my own eyes malware/spyware infecting browsers with modified browser extensions (innocent browser extension, modified to report to attackers/script kiddies) working as keyloggers (using trivial onkey* event handlers, or just input.value checks).

Is there a way (meta tag, etc.) to inform a browser to disallow code injection or reading the DOM, standard or non-standard? The webpage is already SSL, yet this doesn’t seem to matter (as in give a hint to the browser to activate stricter security for extensions).

.

Possible workarounds (kind of a stretch vs. a simple meta tag) suggested by others or off the top of my head:

  • Virtual keyboard for entering numbers + non textual inputs (aka img for digits)
  • remote desktop using Flash (someone suggested HTML5, yet that doesn’t solve the browser extension listening on keyboard events; only Flash, Java, etc. can).
  • Very complex Javascript based protection (removes non white listed event listeners, in-memory input values along with inputs protected with actual asterix characters, etc.) (not feasible, unless it already exists)
  • Browser extension with the role of an antivirus or which could somehow protect a specific webpage (this is not feasible, maybe not even possible without creating a huge array of problems)

Edit: Google Chrome disables extensions in Incognito Mode, however, there is no standard way to detect or automatically enable Incognito Mode and so a permanent warning must be displayed.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    UPDATE (2019-10-16): This isn’t a “real” solution – meaning you should not rely on this as a security policy. Truth is, there is no “real” solution because malicious addons can hijack/spoof JavaScript in a way which in not detectable. The technique below was more of an exercise for me to figure out how to prevent simple key logging. You could expand on this technique to make it more difficult for hackers… but Vlad Balmos said it best in his answer below – Don’t waste your energy trying to cover for users who souldn’t be making payments over the internet in the first place.

    You can get around the key logging by using a javascript prompt. I wrote a little test case (which ended up getting a little out of hand). This test case does the following:

    • Uses a prompt() to ask for the credit card number on focus.
    • Provides a failsafe when users check “prevent additional dialogs” or if the user is somehow able to type in the CC field
    • Periodically checks to make sure event handlers haven’t been removed or spoofed and rebinds/ warns the user when necessary.

    http://jsfiddle.net/ryanwheale/wQTtf/

    prompt('Please enter your credit card number');

    Tested in IE7+, Chrome, FF 3.6+, Android 2.3.5, iPad 2 (iOS 6.0)

    • 0